Security Module

ABSTRACT

A method and apparatus for restricting access of an application to computer hardware. The apparatus includes both an authentication module and a validation module. The authentication module is within the trusted firmware layer. The purpose of the authentication module is to verify a cryptographic key presented by an application. The validation module is responsive to the authentication module and limits access of the application to the computer hardware. The authentication modules may be implemented in software through a firmware call, or through a hardware register of the computer.

CROSS REFERENCE TO RELATED APPLICATION(S)

The present application is a continuation of U.S. patent applicationSer. No. 10/334,483, now pending, and is hereby incorporated byreference.

BACKGROUND OF THE INVENTION

1. Technical Field

This invention relates to an apparatus and method for enabling access torestricted hardware of a computer system. More specifically, a key isprocessed to control the restricted access.

2. Description of the Prior Art

Game sets for use in conjunction with a television set are an everincreasing form of home entertainment. The game sets are computers thatcommonly include an accessory to enable a player to communicate with thegame set. The game sets have evolved over recent years to provide a morerealistic playing experience which requires much real time computationin order to accomplish the desired real time playing experience.Accordingly, the CPU of the game set includes a computer with enhancedcomputing abilities.

Computers comparable to the game set CPU available to the consumer areconsiderably more expensive to purchase than the game set. The expenseassociated with the game set is offset by game accessories. The consumerwho purchases the game set actually purchases the set at a discount. Thegame vendor of the game set loses money on each sale. However, theconsumer price of a game accessory, such as a game cartridge or disc, isconsiderably more expensive than the cost associated with producing thegame. The loss associated with the sale of the game set is overcome inthe sale of the game cartridges. Accordingly, the game vendors have cometo rely on revenues associated with the sale of games for profit andhave accepted the losses associated with the sale of game units.

In view of the sale strategy established by the game vendors, access byindependent software developers to the CPU of the game set isrestricted. This prevents the independent software developer from takingadvantage of the enhanced capabilities of the CPU and creating gamescompatible with the game set and selling them at a reduced cost to theconsumer. However, the access restriction placed on the game set doesnot take into consideration other uses of the CPU by non-competitors.For example, the CPUs of the game sets have enhanced graphics and videocapabilities which could be beneficial to educational institutionsand/or for computer aided design. Similarly, a person who programs as ahobby may have an interest in taking advantage of the enhanced abilitiesof the CPU. Accordingly, there is a need for enabling access to the CPUand enhanced peripherals of the CPU by non-game competing entities,while maintaining restrictions on access by game competing entities.

SUMMARY OF THE INVENTION

This invention comprises a method and apparatus to enable restrictedaccess to computer hardware.

In one aspect of the invention, a method for restricting access tocomputer hardware is provided. The method includes presenting acryptographic key to an authentication module, which is accessed througha trusted firmware layer, and validation of the key. Access of anapplication to the computer hardware is limited in response to the keyvalidation. The step of validating the key may include presenting thekey through a firmware call, which may be in the form of a softwareinterrupt, and a protected procedure call. Alternatively, the step ofvalidating the key may include writing a valid key to a hardwareregister of the computer hardware. The computer hardware may by acentral processing unit of a game set, and it may also include agraphics accelerator, a floating point accelerator, and a highresolution buffer.

Other features and advantages of this invention will become apparentfrom the following detailed description of the presently preferredembodiment of the invention, taken in conjunction with the accompanyingdrawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a flow chart illustrating the process of presenting a key tothe authentication module.

FIG. 2 is a flow chart illustrating the process of instituting achallenged response in conjunction with the presentation of a key to theauthentication module.

FIG. 3 is a flow chart illustrating the process of the verificationapplication following key authentication.

FIG. 4 is a block diagram of the components of the system and thepresentation of a non-valid key by a non-game application to theauthentication module according to the preferred embodiment of thisinvention, and is suggested for printing on the first page of the issuedpatent.

FIG. 5 is a block diagram of the components of the system and thepresentation of a valid key by a non-game application to theauthentication module.

DESCRIPTION OF THE PREFERRED EMBODIMENT Overview

The manufacturers of home entertainment sets leverage the cost of theset for the cost of accessories. The game sets are comprised of CPUswith enhanced graphics and timing, and only authorized software hasaccess to the enhanced hardware of the game set CPU. There is a need toenable non-competitors of the game set manufacturers to be able toaccess the enhanced hardware of the game set through an authorizationsystem.

Technical Background

Each game set has a CPU and associated hardware to enable an authorizedgame to properly function and to provide virtual effects that appear inreal time. Some of the hardware that enables the real time effectsinclude a graphics accelerator, a floating point accelerator and a highresolution frame buffer. In addition, each game set includes a trustedfirmware layer that cannot be replaced with an unauthorized piece offirmware. Firmware is software that is stored in hardware, such that thesoftware is retained even after power to the hardware ceases. At boottime, the firmware of a computer stores and uses information describinga computer's processor, memory and other devices. The firmware operateson a parallel platform to the operating system.

A verification apparatus is provided to enable software and/or hardwareto authenticate access to the CPU and related hardware accessories ofthe game set. The application requesting authorization must present akey, preferably a cryptographic key, to an authentication module. FIG. 1is a flow chart (10) illustrating the process of the applicationrequesting access to the game set CPU and hardware. Following access tothe verification apparatus, (12), the application is queried forpresentation of a key (14). If the application has a key, the key ispresented to an authentication module (16). The key is then tested bythe authentication module to determine if the key presented by theapplication is valid (18). The authentication module is accessed throughthe trusted firmware layer of the CPU. If the key is determined to be avalid key, then a validation module permits the application access tosome or all of the memory and hardware accessories of the game set (20).However, if the key is determined to be an invalid key at step (18),then the validation module prevents the application from access to someor all of the memory and hardware accessories of the game set (22).Similarly if the application does not have a key at step (14), then theauthentication module prevents the application from access to some orall of the memory and hardware accessories of the game set (22).Accordingly, the authentication module functions in conjunction with thevalidation module to control access to restricted memory and hardware ofthe CPU of the game set.

In a further embodiment, the authentication module may include a furtherverification process in which the bits of the key would constantly bechanging. An example of this further verification is shown in the flowchart (30) of FIG. 2. As in FIG. 1, following access to the verificationapparatus, (32), the application is queried for presentation of a key(34). If the application has a key, the key is presented to anauthentication module and the application obtains a value from theauthentication module (36). A new key is then computed (38) based uponthe value obtained from the application in conjunction with the valueobtained from the authentication module at step (36). The new key isthen presented to a validation module (40). If the key is determined tobe a valid key at step (42), then the validation module permits theapplication access to some or all of the memory and hardware accessoriesof the game set (44). However, if the key is determined to be an invalidkey at step (42), then the validation module prevents the applicationfrom access to some or all of the memory and hardware accessories of thegame set (46). Similarly if the application does not have a key at step(34), then the authentication module prevents the application fromaccess to some or all of the memory and hardware accessories of the gameset (46). Accordingly, the authentication module provides a known valueand computes a new key based upon the known value and the key forpresentation to the validation module to control access to restrictedmemory and hardware of the CPU of the game set.

As shown in FIG. 2, the authentication module presents a value fromwhich a new key may be computed for presentation to the validationmodule. The purpose of this further step is to provide a challengedresponse to defeat playback attacks. Once the computed key has beenaccepted by the validation module, the application may access availablehardware and emulate hardware to which access has been denied. Oneexample of a value for computation of the new key is a timestamp. Sincetime is a value that is constantly changing, the key value presented tothe validation module will never be the same. Accordingly, the processoutlined in FIG. 2 is an alternative embodiment that provides an extralevel of protection from unauthorized access to hardware resources.

Following a positive response from the validation module, theapplication may or may not have access to certain hardware resources ofthe game set. FIG. 3 is a flow chart (50) illustrating the processfollowing presentation of the key to the validation module in steps (18)and (42) of FIGS. 1 and 2, respectively. Following presentation to thevalidation module (52), the application will be queried to determine ifit has been provided access to the hardware resources of the CPU (54)based on the response received from steps (18) or (42). If theapplication does have access to the hardware resources, it may use thefull speed game specific hardware available (56). However, if theapplication does not have access to all or some of the hardwareresources, it must emulate the game specific hardware to which it hasbeen denied access (58). Accordingly, the process outlined in FIG. 3shows the steps for the application following the presentation of thekey to the validation module.

FIG. 4 is a block diagram (72) illustrating the different components ofthe game set system. In this illustration either an application with avalid key (74) or an application without a valid key (76) may berequesting access to the hardware components of the game set system. Theauthentication module (78) is within the trusted firmware layer of thesystem (80). In addition, the system includes the hardware (82) of thegame set. The hardware may include a display accelerator (84), a highresolution clock interrupt (86), as well as standard video hardware (88)and CPU memory (90). In this illustration, an application (76) with anon-valid key presents the key to the authentication module (78) withinthe trusted firmware layer (80). The validation module determines thatthe key is not valid and limits access of the non-game application tothe standard video hardware (88). The unauthorized software may emulatethe enhanced functions of the CPU. However, this generally provides poorquality results, such as a slow display, reduced graphics resolution,and/or decreased realism.

Similarly, FIG. 5 is a block diagram (95) illustrating the components ofthe game set system as shown in FIG. 4. However, in this illustration,an application (76) presents a valid key to the authentication module(78) within the trusted firmware layer (80). The validation moduledetermines that the key is valid and enables access of the applicationto the display accelerator (84) and the high resolution clock interrupt(86). Accordingly, FIGS. 4 and 5 are merely illustrative of thestructure of the system and the placement of the authentication modulewithin the trusted firmware layer.

The authentication module may be implemented in software as part of thetrusted firmware layer. In this embodiment, the key is presented to theauthentication module through a firmware call, such as a softwareinterrupt or a protected procedure call. Through the software, theapplication gives the key to the trusted firmware layer which presentsthe key to the validation module. During the interrupt or procedurecall, the software can communicate with the validation module. Anapplication program interface (API) executes a call to enable thevalidation module to either validate or invalidate the key. Uponvalidation of the key the software will be provided or denied access tothe hardware resources of the CPU. In the case of the softwareimplementation of the authentication module, the trusted firmware layercontrols restricted access to the hardware resources. Accordingly, thisenables the software and firmware to communicate with the validationmodule within the firmware layer that stores the addresses for thehardware resources.

Alternatively, the authentication module may utilize hardware registersfor presentation of the key. A set of registers of the CPU are set asidefor assigning key verification instructions. The register is resident ina CPU and an external CPU cannot access the registers of another CPU. Afirst register holds the key address, a second register communicateswith the hardware resource, and a third register may be used to presenta value from which the key must be computed. The third register is onlynecessary in the case of a challenged response where an arbitrary valueis set aside for computation of the key as shown in FIG. 2. Theexecution of an authentication instruction will reference addressesindicated by the first and second registers. The authenticationinstruction specifies a request for authentication of the key addressheld by the first register. Upon validation of the key held by the firstregister, the second register will provide access to the hardware itcontrols. In the embodiment which encompasses computation of the key,the value for the computation is held in the third register. Thecomputation is conducted as shown in step (38) of FIG. 2. Accordingly,the hardware registers may be implemented in conjunction with theauthentication and validation modules to control access of anapplication to hardware resources.

Advantages over the Prior Art

The present invention restricts access to the authentication module byplacing it within the trusted firmware layer of the CPU. The firmwarecontrols the address location of the hardware resources in communicationwith the CPU. As such, the placement of the authentication module withinthe trusted firmware layer provides another level of restriction to thehardware resources. The achievement of the authentication module inconjunction with the validation module enables restricted access to thehardware resources that are otherwise not accessible to non-authorizedapplications. The authentication and validation modules provide limitedaccess to the hardware resources for uses such as research anddevelopment and/or other educational purposes. Accordingly, theauthentication and validation modules provide a level of security to thegame set manufacturers to prevent unauthorized access to the hardwareresources of the game set as well as provide security againstunauthorized access of game accessories to the hardware resources.

Alternative Embodiments

It will be appreciated that, although specific embodiments of theinvention have been described herein for purposes of illustration,various modifications may be made without departing from the spirit andscope of the invention. In particular, the challenged response to thekey may take on a variety of forms either embedded in the software orhardware. Additionally, one could take steps to ensure that the programin the cartridge or disc could not be executed on unauthorized hardwareor on a simulator. One could also take steps to ensure that theexecution of the software on the game set could not be subjected tounauthorized monitoring by a logic analyzer or other equipment.Accordingly, the scope of protection of this invention is limited onlyby the following claims and their equivalents.

1. A method for restricting access to computer hardware comprising:presenting a cryptographic key to an authentication module; accessingsaid authentication module through a trusted firmware layer; validatingsaid key; and limiting access of an application to said computerhardware in response to key validation.
 2. The method of claim 1,wherein the step of validating said key includes presenting said keythrough a firmware call.
 3. The method of claim 2, wherein said firmwarecall is selected from the group consisting of: a software interrupt anda protected procedure call.
 4. The method of claim 1, wherein the stepof validating said key includes writing a valid key to a hardwareregister of said computer hardware.
 5. The method of claims 1, whereinhardware is selected from the group consisting of: a graphicsaccelerator, a floating-point accelerator, a high-resolution framebuffer, and combinations thereof.
 6. The method of claim 1, wherein saidcomputer hardware is a central processing unit of a game set.